CVE-2026-114268 in BE3L Pro
Summary
by MITRE • 10/22/2026
A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security_5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The Tenda BE3L Pro router, specifically firmware version 16.03.60.62, contains a critical remote code execution vulnerability within its web management interface. This flaw resides in the formWifiBasicSet function located in the /goform/WifiBasicSet script, which is responsible for processing configuration changes related to wireless network settings. The core technical issue is a buffer overflow triggered by improper validation of the security_5g argument passed during HTTP requests aimed at configuring 5GHz Wi-Fi parameters. When an attacker supplies a specially crafted payload exceeding the expected buffer size in this specific parameter, it overwrites adjacent memory locations on the stack or heap, leading to arbitrary code execution with the privileges of the web server process running on the device.
This vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input, a classic category of software errors that frequently lead to severe security breaches in embedded systems and Internet of Things devices. The operational impact is significant because it allows an unauthenticated attacker to execute arbitrary commands remotely over the network. Since the vulnerability can be triggered via standard HTTP requests sent to the router's management interface, no physical access or prior authentication is required if the web interface is exposed to the local network or internet. Successful exploitation grants the attacker full control over the device, enabling them to pivot into the internal network, intercept sensitive data, install persistent malware, or use the compromised router as a botnet node for distributed denial-of-service attacks.
The presence of published exploits significantly elevates the risk profile associated with this vulnerability. Attackers can leverage automated scanning tools and existing proof-of-concept code to identify vulnerable devices on large networks without needing specialized knowledge beyond basic networking concepts. This ease of exploitation means that unpatched Tenda BE3L Pro units are highly susceptible to widespread compromise, particularly in environments where default credentials remain unchanged or the management interface is inadvertently exposed to public IP addresses through port forwarding rules.
Mitigation strategies must prioritize immediate remediation and network hardening. The most effective solution is to update the router firmware to a version released after this vulnerability was identified and patched by Tenda. If an official patch is unavailable, administrators should restrict access to the web management interface by disabling remote administration features and ensuring that the administrative port is not forwarded through any upstream firewalls or routers. Additionally, implementing network segmentation can limit lateral movement in case of compromise, while changing default administrator passwords adds a layer of defense-in-depth against other potential attack vectors such as brute-force attempts on authentication mechanisms. Continuous monitoring for unusual outbound traffic from the device can also help detect exploitation attempts early.